Self-Proclaimed KOLs, 'Free' Investment Chatrooms, Quasi-Banking Criminals, and the Damage to the Cryptocurrency Market

Executive Summary

This report prioritizes South Korean cases and reviews public data from the past five years, including comparisons with the US, EU, Singapore, and Japan. It concludes that KOL referrals and Telegram-based investment chatrooms (leading rooms) are not merely "promotion" but often function as a single funnel: Content Inflow → Trust Building in Free Rooms → Conversion to Paid Rooms → Attachment of Referral Links/Codes → Remittance to Unreported Exchanges, Fake Apps, or OTC → Transfer to Overseas Wallets or Off-market Networks. In South Korea, investment chatrooms accounted for the highest proportion (26.5%) of virtual asset investment fraud reports from January to April 2024. The police announced that they merged 7,761 investment chatroom cases involving 14,255 victims into 172 consolidated investigations in 2024. Joint promotional materials from the Financial Supervisory Service (FSS) and the industry, data from the National Investigation Headquarters of the National Police Agency, and the 2025 warnings from the Financial Intelligence Unit (FIU) show that this structure, combined with signal trading, proxy trading, unreported virtual asset businesses, and Telegram USDT OTC trading, has led to actual damages.

Legal issues are not limited to a single crime type. In practice, fraud, quasi-banking (illegal deposit-taking), illegal multi-level marketing, operating an unreported virtual asset business, foreign exchange violations, and concealment of criminal proceeds overlap. Looking at international comparisons, the US has strongly sanctioned undisclosed crypto promotion as a "touting" issue under securities laws; the EU has required social media recommendations and conflict of interest disclosures under the MiCA and Market Abuse Regulation (MAR) frameworks; Singapore has restricted the use of third-party influencers in crypto promotion to the public; and Japan has codified monitoring of affiliate ads, prohibition of excessive incentives, and prohibition of solicitation by unregistered persons through industry self-regulation. In contrast, South Korea's public data shows a greater emphasis on ex-post crackdowns on unreported operations, chatroom fraud, quasi-banking, and illegal multi-level marketing rather than disclosure of paid recommendations and referral rewards.

Quantitatively, the problem is significant. Even by simply combining public data as a lower bound, the 1.39 trillion KRW damage from the Haru Invest/Delio case and the 894.9 billion KRW in reported damages from the 2024 special crackdown on investment chatrooms confirm a public lower bound of at least 2.2849 trillion KRW. This value only includes reported, prosecuted, or publicized cases and is a very conservative figure that excludes unreported damages and overlapping categories. Internationally, investment fraud losses in the US reached $5.7 billion in 2024. Academic research reports that Telegram-based crypto pump-and-dump schemes cause short-term spikes in price, volume, and volatility followed by sharp reversals, with the price of target coins falling by an average of 30% relative to the market one year later. This means that KOL referrals and Telegram chatrooms can not only destroy market trust but also distort liquidity and price discovery functions.

The purpose of this report is fourfold: first, to structurally diagnose the problem; second, to organize legal and regulatory issues from domestic and comparative law perspectives; third, to quantify the impact on market trust, liquidity, volatility, and investor protection to the extent possible; and fourth, to present short-term and mid-to-long-term policy recommendations. Since some internal contracts, actual profit-sharing ratios, and private side letters lack public data, this report uses only conservative interpretations based on public terms and conditions, press releases, court rulings, and academic research.

Problem Structure and Operating Mechanism

Synthesizing domestic official and public data, chatrooms typically draw potential investors from public platforms such as YouTube, SNS, and open chats into Telegram's private environment, which utilizes multiple accounts, bot automation, and invite link structures. They build trust in free rooms and then monetize through paid rooms, VIP rooms, proxy trading, and referral conversions. The FSS casebook provides detailed paths: receiving loss consultations on YouTube channels before being converted to paid member chatrooms, moving from KakaoTalk open chats to virtual asset rooms where registration on unreported exchanges is encouraged, and suffering liquidation losses after handing over account IDs and passwords for proxy trading on Telegram. The FIU has separately warned against anonymous stablecoin OTC and 'Hwan-chigi' (illegal FX matching) structures through Telegram and open chats.

The structure below is reconstructed by synthesizing domestic casebooks, FIU press releases, police data, and international AML/scam-infrastructure data.

The core of KOL referrals is that the monetization of content influence is linked to "generated transaction volume" rather than "accurate recommendations." Most public exchange programs are structured to receive revenue share from the transaction fees of users invited by the referrer, and some combine CPA, hybrid, tier, and sub-affiliate structures. In this structure, KOLs have a high incentive to prioritize transaction frequency, leverage, futures conversion, and new registration conversion rates over investment suitability. Telegram room operators can combine this incentive with signals, proxy trading, and paid rooms, with public KOLs serving the top of that funnel.

KOL Referral Reward Structure and Incentive Flow

Public terms and guidance pages show that these programs are not simple "invite a friend" schemes but rather performance contract systems where exchanges measure performance, adjust ratios, distinguish prohibited jurisdictions, and can terminate contracts. The problem is that reward amounts, held positions, the referrer's own interests, ticker-specific campaign incentives, and side letters are rarely disclosed externally. The EU's 2025-2026 finfluencer guide requires clearly stating whether one profits from the product in addition to money, gifts, or benefits, and the US SEC has sanctioned undisclosed crypto promotion for compensation itself. In South Korea, this remains the largest regulatory gap.

South Korean Law, Regulation, and Investigation Trends

Legal violation types identified in South Korea fall into five main categories. Combining principal/fixed return guarantees with referral commissions increases the risk of quasi-banking and illegal multi-level marketing; signals, proxy trading, and account lending can lead to fraud and unreported virtual asset business issues; and Telegram USDT OTC creates issues with the Specified Financial Information Act and the Foreign Exchange Transactions Act simultaneously. Furthermore, false performance verification, fake exchange apps, inducing 'averaging down' (buying more at lower prices), and high-leverage futures conversion are close to fraudulent unfair trading, which later connects to concealment of criminal proceeds. A study analyzing domestic court rulings found that in illegal multi-level marketing cases, emphasis on high returns was present in 59.1% and recruitment commissions in 62.1%, with an average of 1,050 victims and an average damage amount of approximately 75.3 billion KRW. Courts have also noted the need for strict punishment, viewing chatroom fraud as a sophisticated and organized crime targeting an "unspecified multitude."

The centrality of the chatroom problem in domestic virtual asset fraud is evident from 2024 report data. Among 2,209 reports of virtual asset investment fraud from January to April 2024, the recurring types were investment chatrooms (26.5%), unreported exchanges (18.9%), phishing (17.7%), and quasi-banking (5.25%). These percentages are based on duplicate counts, so the total does not equal 100%, suggesting that chatrooms, unreported exchanges, and quasi-banking can occur simultaneously in a single case.

Recent messages from South Korean financial authorities are relatively clear. As of December 2, 2025, the FIU warned that there are only 27 reported virtual asset service providers (VASPs), and all other operators dealing with virtual assets for domestic residents are illegal. The FIU presented factors such as providing a Korean-language website, supporting KRW payments, and holding events to attract Korean customers as elements for judging business operations targeting domestic residents. It also disclosed cases of anonymous stablecoin exchange OTC and 'Hwan-chigi' structures on Telegram and open chats as detected examples. This means that referral links or inducing entry into Telegram rooms can constitute brokering for unreported VASPs.

Investigation trends are similar. The police announced that they arrested 3,300 people in 7,232 cases through a 17-month special crackdown on investment chatrooms since September 2023, with 734 of them detained. In 2024 specifically, they merged 7,761 cases and 14,255 victims nationwide into 172 consolidated investigations, arresting the masterminds in 27 cases. According to the figures cited in the announcement, the reported damage amount in 2024 was 894.9 billion KRW. Additionally, in February 2024, the prosecution announced indictments in the Haru Invest/Delio deposit service case involving approximately 16,000 victims and 1.39 trillion KRW in damages. This shows that contractual structures promising "return of principal and profit upon deposit" can expand into large-scale quasi-banking and Ponzi-type damages in the virtual asset sector.

The application of law in South Korea is broadening. Courts have ruled that the act of collecting funds from many people to repeatedly buy, sell, or transfer virtual assets and receiving fees can be viewed as a virtual asset business under the Specified Financial Information Act. Meanwhile, the government established a basis for sentencing up to 30 years in prison by raising the statutory penalties for fraud targeting an unspecified multitude, such as jeonse fraud, voice phishing, and investment chatroom fraud, through a revision of the Criminal Act in late 2025. However, as seen in international comparisons, South Korea still lacks comprehensive ex-ante regulations such as mandatory disclosure of rewards for paid crypto KOL promotion, channel-specific disclosures, and registration of referral codes. In public data, the focus of enforcement remains skewed toward "detecting illegal operations and fraud."

Comparison of Major Domestic and International Cases

The implications of this comparison table are clear. The US and EU directly target advertising/reward disclosure and conflicts of interest, while Singapore and Japan preemptively restrict promotion channels and affiliate behavior. In contrast, South Korea's public data shows that enforcement is centered on ex-post crackdowns on unreported operations, chatroom fraud, and illegal multi-level marketing. In other words, while Korean regulation is becoming stronger in "detection after entry," it remains relatively empty regarding "KOL referral transparency before entry."

Market Impact Analysis

Quantitative assessment requires distinguishing between summable figures and non-summable figures due to differing categories. The domestic lower bound confirmed by official investigation, indictment, and report figures is as follows. Here, "Investment Chatroom Damage" is a general figure including stocks, real estate, and virtual assets, while "Haru/Delio" is a single case of a virtual asset deposit-type incident. The sum of the two, 2.2849 trillion KRW, shows the "public lower bound" of the related ecosystem in Korea, but it does not represent total damage or pure crypto-only damage.

Academic research more clearly shows the negative impact on market trust and liquidity. Studies on cryptocurrency pump-and-dump schemes point out that Telegram-based manipulation creates short-term spikes in price, volume, and volatility before quickly reversing, functioning as a structure that transfers wealth from external investors to insiders. Other research identifies low market cap, low trading volume, and social media buzz as primary predictors of pump-and-dumps among coin-specific factors, with high market volatility also acting as a stimulant. Furthermore, a study tracking large-scale Telegram pump events long-term reported that the price of target coins fell by an average of 30% relative to the market one year later. Applying these results to the Korean context, it is reasonable to conclude that the combination of KOL referrals and chatrooms causes the greatest market distortion in low-liquidity altcoins, derivatives, and narratives involving new listings, lock-ups, and airdrops. Both Chainalysis and academic data commonly point to this "attention-driven forced trading" structure.

The points where investor protection fails are also relatively consistent. The FSS casebook specifically shows methods where chatroom operators create multiple rooms, predict a rise in half and a fall in the other half, and then delete the wrong rooms to fabricate a track record; methods of encouraging futures trading to investors suffering losses; methods of requesting account access information for proxy trading on Telegram; and methods of seamlessly connecting KakaoTalk, YouTube, and Telegram to move users to unreported exchanges. This means that false performance, psychological pressure, platform migration, and delegation of authority come as a set. When KOL referrals are combined with this, the referrer's profit depends on transaction frequency and exchange inflow, while the investor's profit depends on minimizing losses, making structural conflicts of interest difficult to resolve.

The possibility of links to money laundering, tax evasion, and fraud cannot be ignored. The FIU disclosed anonymous USDT exchange and 'Hwan-chigi' structures based on Telegram and open chats, and FinCEN pointed out that Huione Group laundered at least $4 billion in illicit proceeds by bundling VASPs, payment services, and guarantee marketplaces. The UN Office on Drugs and Crime (UNODC) also analyzed in a 2024 report that Southeast Asian criminal organizations are expanding cyber fraud and money laundering by combining underground markets, new service-based models, and cryptocurrency solutions. The analysis that VIP channels and alternative infrastructure were maintained even after the mass deletion of Telegram's guarantee services in 2025 shows that this ecosystem is not a simple messenger problem but a criminal infrastructure connecting messengers, OTC, wallets, VASPs, and overseas organizations. TRM Labs assessed that VIP vendor channels and domain reconfiguration continued even after the deletion of public channels related to Huione.

Policy Recommendations

The core of policy should be making it transparent "who sent whom where, for what reward" rather than just "what was recommended." Good combinations from comparative law already exist. The US directly sanctions undisclosed promotion for compensation, the EU requires channel-specific conflict disclosures, Singapore blocks third-party promotion to the public, and Japan blocks actual solicitation and excessive incentives by affiliates. South Korea needs to institutionalize these elements by combining them with crackdowns on chatrooms, quasi-banking, and unreported VASPs.

In the short term, three measures are most urgent. First, reward disclosure must be made a basic requirement for crypto referrals rather than an exception to advertising regulations. Second, blocking inflow to unreported operators must be performed preemptively at the KOL/chatroom distribution network stage rather than as a follow-up to crackdowns. Third, an integrated investigation system that views chatroom cases together with platform, bank, exchange, and on-chain data must be institutionalized. Since South Korea already has some systems for merged chatroom investigations and reporting unreported virtual asset operators, the remaining task is to expand this to transparency regulations for referrals and paid promotion.

In the mid-to-long term, "chatrooms" and "KOLs" should not be viewed as separate issues. Actual risk arises from the combination of the two. KOLs handle inflow and trust; Telegram handles conversion and closedness; unreported exchanges and OTC handle withdrawal control; and overseas guarantee markets and scam centers handle concealment and laundering. Therefore, policies must also be designed as a package of advertising regulation, financial crime investigation, AML, platform responsibility, and investor protection. Otherwise, it is highly likely that a "balloon effect" will repeat, where activity moves to Telegram when KOL public channels close, to VIP rooms when Telegram public channels close, and to OTC, wallets, and alternative domains when VIP rooms close.